DEBIAN-CVE-2025-68256

Advisory lineage Upstream: 1 Downstream: 2
Upstream
CVE-2025-68256
Published: 16 Dec 2025, 15:15
Last modified:15 Jun 2026, 19:05

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

16 Dec 2025, 15:15
Published
Vulnerability first disclosed
15 Jun 2026, 19:05
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser The Information Element (IE) parser rtw_get_ie() trusted the length byte of each IE without validating that the IE body (len bytes after the 2-byte header) fits inside the remaining frame buffer. A malformed frame can advertise an IE length larger than the available data, causing the parser to increment its pointer beyond the buffer end. This results in out-of-bounds reads or, depending on the pattern, an infinite loop. Fix by validating that (offset + 2 + len) does not exceed the limit before accepting the IE or advancing to the next element. This prevents OOB reads and ensures the parser terminates safely on malformed frames.

Affected Systems

  • debian•linux

    all | all | < 6.1.162-1 | < 6.12.63-1 | < 6.17.12-1

  • debian•linux-6.1

    all | < 6.1.162-1~deb11u1

References (1)